@golproductions/check 3.2.7 → 3.2.9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@golproductions/check",
-  "version": "3.2.7",
-  "description": "The anti-hallucination layer for AI coding agents. Stops hallucinated commands, packages, and URLs before they run.",
+  "version": "3.2.9",
+  "description": "Less hallucinations. A command firewall for AI agents: validates every shell command before execution, so fabricated commands are denied before they run.",
   "bin": {
     "check": "src/index.js",
     "check-mcp": "src/mcp.js"

package/src/mcp.js

@@ -2,11 +2,13 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { execFile } from "node:child_process";
+import { execFile, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { platform } from "node:os";
 import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);
-const VERSION = "3.1.8";
+const VERSION = "3.2.8";
 const API = "https://triage.golproductions.com/preflight";
 const CLIENT_ID = process.env.GOL_CLIENT_ID;
 const IS_WIN = process.platform === "win32";
@@ -16,11 +18,110 @@ if (!CLIENT_ID) {
   process.exit(1);
 }
 
+// THE ROD (ported from index.js): do not model the shell — ask it. The
+// machine's own PATH resolution is the ground truth for whether a command
+// exists. Tri-state: true = proven present, false = proven absent, null =
+// cannot be determined without executing — abstain, never guess.
+const PREFIX_WORDS = new Set(["sudo", "nohup", "nice", "time", "timeout", "env"]);
+
+const SHELL_BUILTINS = new Set([
+  "cd", "echo", "printf", "pwd", "export", "set", "unset", "alias", "unalias",
+  "true", "false", "test", "[", "[[", "exit", "return", "break", "continue",
+  "shift", "source", ".", "eval", "exec", "trap", "wait", "jobs", "fg", "bg",
+  "read", "readonly", "local", "declare", "typeset", "let", "getopts", "hash",
+  "type", "command", "builtin", "ulimit", "umask", "times", "dirs", "pushd",
+  "popd", "for", "while", "until", "if", "then", "else", "elif", "fi", "do",
+  "done", "case", "esac", "in", "function", "select", "{", "}", "!",
+]);
+
+// Quote-aware: "./spaced name.sh" is ONE token, and connectors inside
+// quotes are literal text, not separators.
+function segmentBases(command) {
+  const segs = [[]];
+  let cur = "", q = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (q) { if (ch === q) q = null; else cur += ch; continue; }
+    if (ch === '"' || ch === "'") { q = ch; continue; }
+    if (ch === "|" || ch === "&" || ch === ";" || ch === "\n") {
+      if (cur) { segs[segs.length - 1].push(cur); cur = ""; }
+      if (segs[segs.length - 1].length) segs.push([]);
+      if ((ch === "|" || ch === "&") && command[i + 1] === ch) i++;
+      continue;
+    }
+    if (/\s/.test(ch)) { if (cur) { segs[segs.length - 1].push(cur); cur = ""; } continue; }
+    cur += ch;
+  }
+  if (cur) segs[segs.length - 1].push(cur);
+
+  const bases = [];
+  for (const words of segs) {
+    let base = null;
+    for (const w of words) {
+      if (!w) continue;
+      if (PREFIX_WORDS.has(w)) continue;
+      if (/^[\d.]+[smhd]?$/.test(w)) continue;
+      if (w.includes("=") && !w.startsWith("-")) continue;
+      if (w.startsWith("-")) continue;
+      base = w;
+      break;
+    }
+    if (base) bases.push(base);
+  }
+  return bases;
+}
+
+// On Windows, bare "bash" is a trap: PATH can resolve to WSL's
+// System32\bash.exe — a different operating system. The MCP executor
+// runs cmd on Windows, but the probe still asks Git Bash for bash-family
+// commands; if it cannot be located, abstain.
+function bashPath() {
+  if (platform() !== "win32") return "bash";
+  const candidates = [
+    process.env.CLAUDE_CODE_GIT_BASH_PATH,
+    "C:/Program Files/Git/bin/bash.exe",
+    "C:/Program Files/Git/usr/bin/bash.exe",
+    "C:/Program Files (x86)/Git/bin/bash.exe",
+  ].filter(Boolean);
+  for (const c of candidates) { try { if (existsSync(c)) return c; } catch {} }
+  return null;
+}
+
+function shellKnows(name) {
+  try {
+    const bash = bashPath();
+    if (!bash) return null;
+    const r = spawnSync(bash, ["-c", 'type -- "$1" >/dev/null 2>&1', "check", name],
+      { timeout: 4000, stdio: "ignore" });
+    return r.error ? null : r.status === 0;
+  } catch { return null; }
+}
+
+function allBinariesExist(command) {
+  try {
+    let bases = segmentBases(command);
+    bases = bases.filter(b => !SHELL_BUILTINS.has(b));
+    if (bases.length === 0) return true;
+    if (bases.some(b => /[(){}$`]/.test(b))) return null;
+    let verdict = true;
+    for (const b of bases) {
+      const known = shellKnows(b);
+      if (known === null) return null;
+      if (known === false) verdict = false;
+    }
+    return verdict;
+  } catch { return null; }
+}
+
 async function validate(command) {
+  // Ask the interpreter before asking the server, same as the hook client.
+  const exists = allBinariesExist(command);
+  const body = { command, v: VERSION, channel: "mcp", platform: "mcp" };
+  if (exists !== null) body.binary_exists = exists;
   const res = await fetch(API, {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-GOL-CLIENT-ID": CLIENT_ID, "User-Agent": "c/" + VERSION },
-    body: JSON.stringify({ command, v: VERSION, channel: "mcp", platform: "mcp" })
+    body: JSON.stringify(body)
   });
   const d = await res.json();
   d._status = res.status;